https://community.splunk.com/t5/Getting-Data-In/How-to-import-sysmon-logs-to-Splunk/m-p/657631#M111301 <P>I found a solution by editing the inputs.conf file as follows.</P><P>&nbsp;</P><LI-CODE lang="markup">[WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = true index= sysmon source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational</LI-CODE> Thu, 14 Sep 2023 14:55:26 GMT onurasln55 2023-09-14T14:55:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-import-sysmon-logs-to-Splunk/m-p/656506#M111176 <P>I choose source from forwarded input selection to input in splunk. I can't see sysmon in logs from source. I made the inputs.conf setting via forwarder, unfortunately I couldn't see it again. I have logs. There are forwarders. My other logs are coming. The sysmon log is not coming.</P> <P>I would appreciate your help.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="forwarded event.png" style="width: 972px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27051i7C07621AC619E447/image-size/large?v=v2&amp;px=999" role="button" title="forwarded event.png" alt="forwarded event.png" /></span></P> <P>&nbsp;</P> <P>not sysmon log&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="not systmon.png" style="width: 490px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27052iD7D305289AE1094B/image-size/large?v=v2&amp;px=999" role="button" title="not systmon.png" alt="not systmon.png" /></span>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="inputconf.png" style="width: 584px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27055i51E054B531673B60/image-size/large?v=v2&amp;px=999" role="button" title="inputconf.png" alt="inputconf.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sysmon log.png" style="width: 505px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27053i8065016F89FCCC5E/image-size/large?v=v2&amp;px=999" role="button" title="sysmon log.png" alt="sysmon log.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="log name.png" style="width: 514px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27054iDB9DEF67079938C4/image-size/large?v=v2&amp;px=999" role="button" title="log name.png" alt="log name.png" /></span></P> Thu, 14 Sep 2023 16:32:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-import-sysmon-logs-to-Splunk/m-p/656506#M111176 onurasln55 2023-09-14T16:32:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-import-sysmon-logs-to-Splunk/m-p/656552#M111179 <P>Hi,</P><P>Did you check your default index? It would be <STRONG>main</STRONG> if you didn't change it.</P><P>smurf</P> Mon, 04 Sep 2023 09:06:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-import-sysmon-logs-to-Splunk/m-p/656552#M111179 smurf 2023-09-04T09:06:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-import-sysmon-logs-to-Splunk/m-p/657631#M111301 <P>I found a solution by editing the inputs.conf file as follows.</P><P>&nbsp;</P><LI-CODE lang="markup">[WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = true index= sysmon source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational</LI-CODE> Thu, 14 Sep 2023 14:55:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-import-sysmon-logs-to-Splunk/m-p/657631#M111301 onurasln55 2023-09-14T14:55:26Z